React EUVD-2025-17558

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects HIGH severity due to network-accessible attack vector, low complexity, and no privilege requirements. However, real-world risk assessment requires context: (1) Exploitation requires access to the compiled binary, typically obtained post-distribution (app store, APK mirrors, or direct device access), making this primarily a supply-chain and post-breach concern rather than a pure network exploit; (2) The vulnerability is automatable and non-complex, suggesting moderate EPSS probability if tools exist; (3) This is NOT a KEV (Known Exploited Vulnerability) in active campaigns based on standard threat intelligence, but the low barrier to exploitation means once disclosed, mass exploitation becomes trivial; (4) The confidentiality impact is HIGH only if sensitive credentials are actually embedded—impact scales with the secrets involved. SSVC decision: if the library is used for hardcoded API keys or authentication material, this is PATCH NOW tier; if used only for symmetric encryption of user data, it's important but slightly lower urgency. The lack of complexity makes this a strong candidate for immediate patching in deployed apps, particularly those handling sensitive authentication.

An attacker obtains a compiled .apk or .ipa file of an application using react-native-keys 0.7.11, either through app store scraping, insider access, or device extraction. Using free tools like objdump, strings, or radare2, the attacker performs static analysis on the native libraries (.so files on Android or Mach-O binaries on iOS) and searches for Base64 patterns or known cipher markers. Within minutes, the attacker extracts plaintext encryption keys, API tokens, or authentication credentials embedded in the binary during compilation. With these secrets, the attacker can: (1) decrypt sensitive data encrypted by the app; (2) impersonate the application in backend API calls; (3) access user accounts or backend systems if API keys are exposed; (4) laterally move through connected services that share compromised credentials. This scenario does not require network connectivity during exploitation (AV:N refers to attack vector post-delivery), making it a high-confidence supply-chain attack. A proof-of-concept would typically demonstrate binary extraction and secret recovery, likely published on GitHub or security advisory databases within days of CVE publication.